Guarding Agentic AI
“It's less that nothing has ever gone wrong and more that the system is built to surface problems early”
Yossi Bronshtein, Head of Security & IT at Unframe, joined CTech to share his thoughts on agentic AI security, and why he's skeptical of anyone, including his own team, who claims a clean incident record.
“So far, no,” said Yossi Bronshtein, Head of Security & IT at Unframe, on whether they've had an incident or near-miss tied to an AI agent doing something it shouldn't have. “That's largely down to the verification process we run from the earliest stages of a POC, with a back-and-forth review loop rather than a black-box handoff. Our QA process catches issues before they reach production, and a confidence module flags low-certainty outputs for human review rather than letting an agent act on them.”
“It's less that nothing has ever gone wrong and more that the system is built to surface problems early, while they're still cheap to catch, instead of after an agent has already acted on bad information,” he explained.
CTech reached out to a spread of Israeli companies to find out how they're actually handling agentic AI security, and whether local security leaders are ahead of the curve on the risk, or simply closer to it.
Are any AI agents currently operating with real autonomy?
It's mixed, not fully one or the other. Most agents in our environment still run with a human checkpoint at the consequential steps, but some things are fully autonomous today. Release notes generation is a good example: our agents write and publish those without a human reviewing each one first, because the task is well scoped and low risk if imperfect. The line we draw isn't "autonomous versus supervised" as a blanket rule. It's based on what happens if the agent gets it wrong. Low-stakes, well-bounded tasks run on their own. Anything touching customer data or external systems still has a human in the loop.
What security controls are in place versus on the roadmap?
Nothing here is ad hoc. Every agent declares a capability manifest upfront: what data it touches, what tools it can call, and what it can reach outside our systems, before approval to go live. Tool calls run through runtime policy gates that allow, deny, or mask each call, with everything logged for audit. New agent versions go through a separate review and approval step, and higher-risk agents get scored against a weighted risk model first. Where a step has real consequences, we put a human-in-the-loop checkpoint in the pipeline instead of letting it run through.
What's your biggest fear about agentic AI rollout in the tech industry right now?
My biggest fear is customer data, especially PII, leaking out of a hosted solution into the open world. Agentic systems like ours interact with the public internet by nature, which widens the attack surface compared to a closed, air-gapped tool. Every integration point, every API call an agent makes outward, is a place data can leave a boundary it shouldn't. That's less a fear about agents making a wrong decision and more a fear about the perimeter itself: making sure what's meant to stay inside a customer's environment actually does, even as agents are built to reach outward.
Where has AI already made things better or safer?
I'd frame the win as the shift to co-working with AI agents. Agents are replacing the lag between a signal showing up and someone having the context to act on it. Most of what used to slow our internal teams down wasn't the decision itself. It was everything upstream of the decision: pulling the data together, checking it against the right sources, and getting it in front of the right person before it went stale. That's where agents are already making a real difference internally.
